1. Field of the Invention
The present invention relates generally to controlling interactions between members of a collaboration. In particular, the present invention addresses limitations in implementing control-flow and access control when participating in a collaboration.
2. Background Art
Collaborative business processes rely on close agreement between participants concerning control-flow decisions between workflow systems and access control to member resources. As participating members interact, members update access control policies corresponding to a change in control-flow state resulting from their interaction. Traditionally, participants in a collaboration use explicit representation of control-flow states. In explicit representation, control-flow state information is maintained separate from an access control policy. The exclusion of control-flow information from policies results in primitive access controls, wherein a given policy defines a triplet <subject s, object o, action a>. This primitive access control policy states that a subject s can perform action a on object o. The protection state of a system at any given time is represented by the collection of triples installed across the set of access controllers in the system. A subject s makes a request to perform an action a on an object o according to a matching access control. The subject s must be authenticated or prove possession or a role or capability that allows the particular type of action a to be performed on object o.
Explicit representation and the use of primitive access control depends on reconfiguration of access control policies by a control-flow component, e.g. a workflow engine. However, access control is not sufficiently central to workflow engine functionality, and system administrators are tasked with low-level configuration of access control policies on the workflow engine. This manual configuration tends to be error-prone given its technical complexity and the time constraints under which the system administrators are placed. As collaborations grow in size, speed and complexity, the potential for these errors increases.
Collaborations are growing in complexity as participants increasingly turn to collaboration choreography. Collaborative organizations are using descriptive choreography to represent the relationship between collaboration members and the interactions that take place between them. Choreographies describe a collaboration from a global point of view, focusing on the observable behaviors by the participants. An overall description of the collaboration uses a choreography (in a choreography description language) while the individual members specify their access controls using their own languages. The standardization and convenience offered by choreography languages allows for more sophisticated collaborative business processes.
The Web Services Choreography Description Language (WS-CDL) (N. Kavantzas, D. Burdett, et al. Web Services Choreography Description Language Version 1.0, available at http://www.w3.org/TR/ws-cdl-10/, 2005) is one example of an emerging, XML-based standard for a language to describe a choreography, specifically for a web service collaboration. WS-CDL consists of type definitions, activities and variables. Some examples of WS-CDL type definitions include RoleType, ParticipantType, RelationshipType and ChannelType. Data types are defined as InformationTypes and Tokens. WS-CDL activities form the basic description of how actions take place in the collaboration. Notable activities include control-flow statements (Sequence, Parallel, and Choice), web service calls (InterAction), internal actions (SilentAction and NoAction) and variable assignment (Assign). WorkUnit is an activity that encompasses other activities and allows conditions to be set for their execution or repetition. Through these and other elements of WS-CDL, a complete descriptive choreography can be provided for highly sophisticated collaborations. While WS-CDL is one example of descriptive choreography, the present invention is directed toward any choreography-based collaboration.
The most sophisticated collaborations to date are embodied in the concept of a virtual organization (VO). A VO is a collection of autonomous parties that use information technology to virtually combine their resources and exchange information in order to collectively address a business objective. By way of contrast, non-virtual collaborations must physically move and transport resources and information. The VO may quickly form once the parties electronically communicate their consent to participation, and can immediately cease to exist once the business objective has been achieved. A VO provides easier access to information and functionality, which have a sensitivity and price associated with them. It is therefore necessary to more closely specify, order and limit the set of transactions and resource accesses that can occur between collaborating parties in a VO. As mentioned above, the present invention is directed to all collaborations, and is not limited to virtual organizations.
Sophisticated collaborations such as VOs reveal the inadequacy of implementing access control under current methods. It is not feasible for these collaborations to rely on a dedicated system administrator to manually configure access control as part of the operation of a workflow engine. The present invention is a response to the need for high-level, on-demand generation of access controls policies directly from the choreography.